The correct answer is to create custom IAM policies that grant only the necessary S3 actions on specific buckets. This directly implements the least privilege IAM policy for EC2 S3 access by scoping permissions to only the required API calls—such as GetObject or PutObject—on explicitly defined bucket ARNs, rather than using wildcard resources or broad S3 actions like s3:*. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your ability to distinguish between identity-based and resource-based policies; a common trap is assuming S3 bucket policies alone solve the problem, but they are complementary, not a replacement for scoping the IAM role. Another frequent mistake is confusing instance profiles (which are merely containers for roles) with the actual policy attachment. Memory tip: think “specific actions on specific ARNs” to avoid the wildcard trap.
SCS-C02 Identity and Access Management Practice Question
This SCS-C02 practice question tests your understanding of identity and access management. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses IAM roles for EC2 instances to access S3. A security audit reveals that some instances have roles with overly permissive policies. What is the BEST practice to scope down permissions while maintaining functionality?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create custom IAM policies that grant only the necessary S3 actions on specific buckets
Option A is correct because the principle of least privilege is applied by granting only required actions on specific resources. Option B is wrong because S3 bucket policies are resource-based and can be used in addition. Option C is wrong because using the root user is insecure. Option D is wrong because instance profiles are just containers for roles.
Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use S3 bucket policies instead of IAM policies
Why it's wrong here
Bucket policies only apply to that bucket, not all S3 access.
✗
Attach the AdministratorAccess policy to the role and use S3 conditions
Why it's wrong here
AdministratorAccess is overly permissive.
✓
Create custom IAM policies that grant only the necessary S3 actions on specific buckets
Why this is correct
Least privilege is best practice.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Authentication checks who the user is.
✗
Create a new instance profile with a more restrictive permissions boundary
Why it's wrong here
Permissions boundary is not a primary solution.
Common exam traps
Common exam trap: authentication is not authorization
Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.
Detailed technical explanation
How to think about this question
This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.
KKey Concepts to Remember
Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.
TExam Day Tips
→Do not assume successful login means full administrative access.
→Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
→Separate login problems from permission problems before choosing the answer.
Key takeaway
Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related SCS-C02 questions on access control and AAA configuration.
Identity and Access Management — This question tests Identity and Access Management — Authentication checks who the user is..
What is the correct answer to this question?
The correct answer is: Create custom IAM policies that grant only the necessary S3 actions on specific buckets — Option A is correct because the principle of least privilege is applied by granting only required actions on specific resources. Option B is wrong because S3 bucket policies are resource-based and can be used in addition. Option C is wrong because using the root user is insecure. Option D is wrong because instance profiles are just containers for roles.
What should I do if I get this SCS-C02 question wrong?
Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related SCS-C02 questions on access control and AAA configuration.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Authentication checks who the user is.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer notices that an IAM user, 'svc-backup', has full S3 access (s3:*) to all buckets. The engineer wants to restrict the user to only put objects into a specific bucket named 'mycompany-backup' and deny all other S3 actions. Which IAM policy should be attached?
Why D: Option C is correct because it explicitly allows s3:PutObject on the target bucket and denies all other S3 actions. Option A is wrong because it only allows s3:PutObject but does not deny other actions, so other S3 actions would still be allowed if the user has another policy granting them. Option B is wrong because it allows all S3 actions on the bucket, which is too broad. Option D is wrong because it denies all S3 actions except PutObject, but the Deny effect with NotAction can be confusing; however, the more straightforward approach is Option C.
Variation 2. A company is using IAM roles to grant EC2 instances access to an S3 bucket. The security team wants to ensure that the instances can only access their own bucket. Which policy should be attached to the IAM role to enforce this?
Why D: Option C is correct because the condition aws:SourceIp is not relevant for EC2 instances; the correct approach is to use a resource-based policy on the S3 bucket that allows access only from the IAM role. Option A is wrong because it allows all S3 actions. Option B is wrong because it allows all resources. Option D is wrong because it uses an IP condition that is not applicable.
Variation 3. A security engineer is designing a system to manage access to an S3 bucket containing confidential data. Which TWO actions should the engineer take to implement least privilege?
medium
✓ A.Use a condition in the IAM policy to restrict access to requests from a specific IP range.
✓ B.Grant only the specific S3 actions needed (e.g., s3:GetObject) rather than s3:*
C.Use a policy that allows s3:* for all users in the organization.
D.Make the bucket public and rely on object ACLs to restrict access.
E.Use pre-signed URLs for all access to the bucket.
Why A: Option A and D are correct. Option A: granting only required actions limits permissions. Option D: using a condition for source IP restricts access to known networks. Option B is wrong because full access is not least privilege. Option C is wrong because pre-signed URLs are for temporary access, not for ongoing least privilege. Option E is wrong because public access is the opposite.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.